refactor: replace Bun.file/write/which/spawn/sleep/Glob/semver/uuid with Node.js APIs

Replace all Bun-specific API calls in src/ with Node.js equivalents,
continuing the Bun → Node.js migration.

Groups replaced:
- Bun.file().text/json/exists/stat/size/lastModified → node:fs/promises
- Bun.write() → writeFile from node:fs/promises
- Bun.write(dest, Bun.file(src)) → copyFile from node:fs/promises
- Bun.which() → new src/lib/which.ts helper (uses 'command -v' on Unix)
- Bun.spawn/spawnSync → spawn/spawnSync from node:child_process
- Bun.sleep() → setTimeout from node:timers/promises
- Bun.Glob → picomatch (already a devDependency)
- Bun.randomUUIDv7() → uuidv7 package (already a devDependency)
- Bun.semver.order() → semver.compare (already a devDependency)

Remaining Bun APIs (Group D — to be addressed separately):
- Bun.file().writer() in bspatch.ts and upgrade.ts
- Bun.zstdCompress/DecompressSync in sourcemaps.ts and bspatch.ts
- Bun.mmap() in bspatch.ts
- Bun.CryptoHasher in bspatch.ts
- bun:sqlite fallback in sqlite.ts (removed when tests migrate to Vitest)

30 files changed, 7012 tests pass, 0 failures.

Author: BYK

.lore.md

@@ -5,6 +5,7 @@
  * Similar to 'gh api' for GitHub.
  */
 
+import { access, readFile } from "node:fs/promises";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
 import type { SentryContext } from "../context.js";
@@ -828,11 +829,14 @@ export async function buildBodyFromInput(
   if (inputPath === "-") {
     content = await readStdin(stdin);
   } else {
-    const file = Bun.file(inputPath);
-    if (!(await file.exists())) {
+    const exists = await access(inputPath).then(
+      () => true,
+      () => false
+    );
+    if (!exists) {
       throw new ValidationError(`File not found: ${inputPath}`, "input");
     }
-    content = await file.text();
+    content = await readFile(inputPath, "utf-8");
   }
 
   // Try to parse as JSON for the API client

AGENTS.md

@@ -14,8 +14,10 @@
  * so that subsequent bare `sentry cli upgrade` calls use the same channel.
  */
 
+import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname } from "node:path";
+import { setTimeout } from "node:timers/promises";
 import type { SentryContext } from "../../context.js";
 import {
   determineInstallDir,
@@ -425,12 +427,14 @@ async function spawnWithRetry(
 ): Promise<number> {
   for (let attempt = 1; attempt <= SPAWN_MAX_ATTEMPTS; attempt++) {
     try {
-      const proc = Bun.spawn([binaryPath, ...args], {
-        stdout: "inherit",
-        stderr: "inherit",
+      const proc = spawn(binaryPath, args, {
+        stdio: ["ignore", "inherit", "inherit"],
         env,
       });
-      return await proc.exited;
+      return await new Promise<number>((resolve) => {
+        proc.on("close", (code) => resolve(code ?? 1));
+        proc.on("error", () => resolve(1));
+      });
     } catch (error) {
       // Translate the opaque Bun "Executable not found" error into an
       // actionable UpgradeError. This path triggers when the binary at
@@ -454,7 +458,7 @@ async function spawnWithRetry(
       log.warn(
         `Binary is locked (antivirus scan?), retrying in ${delay}ms... (attempt ${attempt}/${SPAWN_MAX_ATTEMPTS})`
       );
-      await Bun.sleep(delay);
+      await setTimeout(delay);
     }
   }
   // Unreachable — the loop either returns or throws

src/commands/api.ts

@@ -5,6 +5,7 @@
  * and optional client-side glob filtering by title.
  */
 
+import picomatch from "picomatch";
 import type { SentryContext } from "../../context.js";
 import { MAX_PAGINATION_PAGES } from "../../lib/api/infrastructure.js";
 import {
@@ -233,7 +234,7 @@ function processPage(
     limit: number;
     serverCursor: string | undefined;
     afterId: string | undefined;
-    glob: InstanceType<typeof Bun.Glob> | undefined;
+    glob: ((input: string) => boolean) | undefined;
   }
 ): PageResult {
   // When resuming mid-page, find the afterId and skip everything up to and
@@ -249,7 +250,7 @@ function processPage(
 
   for (let i = startIdx; i < data.length; i++) {
     const item = data[i] as DashboardListItem;
-    if (!opts.glob || opts.glob.match(item.title.toLowerCase())) {
+    if (!opts.glob || opts.glob(item.title.toLowerCase())) {
       results.push(item);
       if (results.length >= opts.limit) {
         return {
@@ -283,7 +284,7 @@ async function fetchDashboards(
     perPage: number;
     serverCursor: string | undefined;
     afterId: string | undefined;
-    glob: InstanceType<typeof Bun.Glob> | undefined;
+    glob: ((input: string) => boolean) | undefined;
   }
 ): Promise<FetchResult> {
   let { serverCursor, afterId } = opts;
@@ -434,7 +435,7 @@ export const listCommand = buildListCommand("dashboard", {
     const { serverCursor, afterId } = decodeCursor(rawCursor ?? "");
 
     const glob = titleFilter
-      ? new Bun.Glob(titleFilter.toLowerCase())
+      ? picomatch(titleFilter.toLowerCase(), { dot: true })
       : undefined;
 
     // When filtering, fetch max-size pages to minimize round trips.

src/commands/cli/upgrade.ts

@@ -10,6 +10,7 @@
  */
 
 import { accessSync, constants, existsSync, mkdirSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { captureException } from "@sentry/node-core/light";
 import { SKILL_FILES } from "../generated/skill-content.js";
@@ -68,7 +69,7 @@ async function writeSkillFiles(
       if (!existsSync(dir)) {
         mkdirSync(dir, { recursive: true, mode: 0o755 });
       }
-      await Bun.write(fullPath, content);
+      await writeFile(fullPath, content, "utf-8");
       if (relativePath.startsWith("references/")) {
         referenceCount += 1;
       }

src/commands/dashboard/list.ts

@@ -5,15 +5,17 @@
  * Used by both `setup --install` (fresh installs) and `upgrade` (self-updates).
  */
 
+import { spawnSync } from "node:child_process";
 import {
   existsSync,
   readFileSync,
   renameSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { chmod, mkdir, unlink } from "node:fs/promises";
+import { chmod, copyFile, mkdir, unlink } from "node:fs/promises";
 import { delimiter, join, resolve } from "node:path";
+import { compare as semverCompare } from "semver";
 import { getUserAgent } from "./constants.js";
 import {
   buildTlsErrorDetail,
@@ -56,9 +58,8 @@ export function isMusl(): boolean {
 
   // Heuristic 2: ldd --version output (musl ldd writes "musl libc" to stderr)
   try {
-    const result = Bun.spawnSync(["ldd", "--version"], {
-      stdout: "pipe",
-      stderr: "pipe",
+    const result = spawnSync("ldd", ["--version"], {
+      stdio: ["ignore", "pipe", "pipe"],
     });
     const output =
       Buffer.from(result.stdout).toString() +
@@ -130,7 +131,7 @@ export function isNightlyVersion(version: string): boolean {
  * @returns 1 if a > b, -1 if a < b, 0 if equal
  */
 export function compareVersions(a: string, b: string): -1 | 0 | 1 {
-  return Bun.semver.order(a, b);
+  return semverCompare(a, b);
 }
 
 /**
@@ -451,7 +452,7 @@ export async function installBinary(
       }
 
       // Copy source binary to temp path next to install location
-      await Bun.write(tempPath, Bun.file(sourcePath));
+      await copyFile(sourcePath, tempPath);
 
       // Set executable permission (Unix only)
       if (process.platform !== "win32") {

src/lib/agent-skills.ts

@@ -2,10 +2,18 @@
  * Browser utilities
  *
  * Cross-platform utilities for interacting with the user's browser.
- * Uses Bun.spawn and Bun.which for process management.
+ * Uses child_process.spawn and whichSync for process management.
  */
 
+import { spawn } from "node:child_process";
+import { setTimeout } from "node:timers/promises";
 import { generateQRCode } from "./qrcode.js";
+import { whichSync } from "./which.js";
+
+/** No-op error handler to prevent unhandled error crashes from spawn. */
+function noop(): void {
+  // Intentionally empty — absorbs async spawn errors (e.g., ENOENT)
+}
 
 /**
  * Open a URL in the user's default browser.
@@ -20,10 +28,10 @@ export async function openBrowser(url: string): Promise<boolean> {
   let args: string[];
 
   if (platform === "darwin") {
-    command = Bun.which("open");
+    command = whichSync("open");
     args = [url];
   } else if (platform === "win32") {
-    command = Bun.which("cmd");
+    command = whichSync("cmd");
     args = ["/c", "start", "", url];
   } else {
     // Linux and other Unix-like systems - try multiple openers
@@ -35,7 +43,7 @@ export async function openBrowser(url: string): Promise<boolean> {
       "kde-open",
     ];
     for (const opener of linuxOpeners) {
-      command = Bun.which(opener);
+      command = whichSync(opener);
       if (command) {
         break;
       }
@@ -48,13 +56,15 @@ export async function openBrowser(url: string): Promise<boolean> {
   }
 
   try {
-    const proc = Bun.spawn([command, ...args], {
-      stdout: "ignore",
-      stderr: "ignore",
+    const proc = spawn(command, args, {
+      stdio: ["ignore", "ignore", "ignore"],
     });
+    // Prevent unhandled error crash if the binary disappears between
+    // whichSync() and spawn() (TOCTOU window).
+    proc.on("error", noop);
 
     // Give browser time to open, then detach
-    await Bun.sleep(500);
+    await setTimeout(500);
     proc.unref();
     return true;
   } catch {

src/lib/binary.ts

@@ -31,7 +31,7 @@
  */
 
 import { constants, copyFileSync } from "node:fs";
-import { unlink } from "node:fs/promises";
+import { readFile, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -269,7 +269,7 @@ async function loadOldBinary(oldPath: string): Promise<OldFileHandle> {
       /* May not exist if copyFileSync failed */
     });
     return {
-      data: new Uint8Array(await Bun.file(oldPath).arrayBuffer()),
+      data: new Uint8Array(await readFile(oldPath)),
       cleanup: () => {
         // Data is in JS heap — no temp file to clean up
       },

src/lib/browser.ts

@@ -5,7 +5,9 @@
  * Includes both low-level copy function and interactive keyboard-triggered copy.
  */
 
+import { spawn } from "node:child_process";
 import { logger } from "./logger.js";
+import { whichSync } from "./which.js";
 
 const log = logger.withTag("clipboard");
 
@@ -29,18 +31,18 @@ export async function copyToClipboard(text: string): Promise<boolean> {
   let args: string[] = [];
 
   if (platform === "darwin") {
-    command = Bun.which("pbcopy");
+    command = whichSync("pbcopy");
     args = [];
   } else if (platform === "win32") {
-    command = Bun.which("clip");
+    command = whichSync("clip");
     args = [];
   } else {
     // Linux - try xclip first, then xsel
-    command = Bun.which("xclip");
+    command = whichSync("xclip");
     if (command) {
       args = ["-selection", "clipboard"];
     } else {
-      command = Bun.which("xsel");
+      command = whichSync("xsel");
       if (command) {
         args = ["--clipboard", "--input"];
       }
@@ -52,16 +54,20 @@ export async function copyToClipboard(text: string): Promise<boolean> {
   }
 
   try {
-    const proc = Bun.spawn([command, ...args], {
-      stdin: "pipe",
-      stdout: "ignore",
-      stderr: "ignore",
+    const proc = spawn(command, args, {
+      stdio: ["pipe", "ignore", "ignore"],
     });
 
-    proc.stdin.write(text);
-    proc.stdin.end();
+    const { stdin } = proc;
+    if (stdin) {
+      stdin.write(text);
+      stdin.end();
+    }
 
-    const exitCode = await proc.exited;
+    const exitCode = await new Promise<number>((resolve) => {
+      proc.on("close", (code) => resolve(code ?? 1));
+      proc.on("error", () => resolve(1));
+    });
     return exitCode === 0;
   } catch {
     return false;